Enables DID registration, cryptographic signing, verification, Relay connection, and end-to-end encryption for secure AI agent communication.

This skill appears to implement what it claims, but review these points before installing: - Key storage: the vault stores privateKey and publicKey as hex in data/keystore/<localId>.keys.json (mode 0o600). Make sure the skill will run in a directory where those files are appropriately protected and that you accept local disk storage of secret material. Consider running in an isolated container or using a hardware-backed keystore if available. - Relay endpoints: the code will connect to any relayUrl you provide (default ws://localhost:3001). Only connect to relays you trust; verify the relay server address before invoking network.connect to avoid connecting to untrusted hosts. - Packaging/build: plugin.json points to dist/index.js but the bundle provides source files (index.js/index.ts) and no dist/. The platform will need to install npm deps and possibly build. Verify the exact install/build steps and dependency integrity (npm registry, lockfile) before running. - Dependencies: verify and audit dependencies (libsodium-wrappers, ws, uuid and transitive deps). The bundle contains a package-lock.json — use it to validate package integrity or vendor the dependencies if you require stricter supply-chain controls. - Small oddities: an included dependency 'loro' appears in package.json but is unused in the code; this is likely harmless but worth confirming there are no hidden/unused modules that might be introduced later. If you need higher assurance, run the skill in an isolated environment, inspect the keystore files after registration, and perform a network capture while exercising network.connect to confirm it only talks to intended relays.

Type: OpenClaw Skill Name: agent-comm-skill Version: 0.1.0 The skill bundle provides legitimate cryptographic and networking primitives for AI agent communication, including DID registration, Ed25519 signing, and E2EE using libsodium. The implementation in index.ts and scripts/vault.js aligns perfectly with the stated purpose in SKILL.md, utilizing standard libraries (libsodium-wrappers, ws, loro) for secure identity management and message passing. No evidence of data exfiltration, malicious execution, or prompt injection was found; sensitive keys are stored locally with appropriate file permissions (0o600).